[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFW4PZ4NKSYSAGXTCC7QHE":3,"skill-same:01M6AFW4PZ4NKSYSAGXTCC7QHE":122},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":63,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":70,"ownerDescription":71,"updatedAt":72,"install":73,"resources":86},"01M6AFW4PZ4NKSYSAGXTCC7QHE","performing-kubernetes-etcd-security-assessment",null,"Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","performing kubernetes etcd security assessment","assessment","kubernetes","kube-bench","control-plane","secrets","security-assessment","etcd","backup","tls","REST","cybersecurity","encryption","container-security","control plane","benchmark","policy","pr","rbac","2026-11-10 10:12:30",false,"---\nname: performing-kubernetes-etcd-security-assessment\ndescription: >-\n  Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest,\n  TLS peer and client transport, access control, backup encryption, and network isolation. Use\n  when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest,\n  or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in\n  plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS,\n  snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use\n  performing-kubernetes-cis-benchmark-with-kube-bench.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- kubernetes\n- etcd\n- encryption\n- tls\n- security-assessment\n- backup\n- secrets\n- control-plane\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n- T1573\n---\n\n# Performing Kubernetes etcd Security Assessment\n\n## Overview\n\netcd is the distributed key-value store that serves as Kubernetes' backing store for all cluster data, including Secrets, RBAC policies, ConfigMaps, and workload configurations. Without proper hardening, etcd exposes all cluster secrets in plaintext, making it the highest-value target for attackers who gain control plane access. A comprehensive security assessment covers encryption at rest, TLS for transport, access control, backup security, and network isolation.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing kubernetes etcd security assessment\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Access to Kubernetes control plane nodes\n- SSH access to etcd cluster nodes (or etcdctl configured)\n- CIS Kubernetes Benchmark reference document\n- Understanding of TLS certificate management and EncryptionConfiguration\n\n## Assessment Areas\n\n### 1. Encryption at Rest\n\nVerify that Kubernetes encrypts Secret data stored in etcd:\n\n```bash\n# Check if EncryptionConfiguration is configured on API server\nps aux | grep kube-apiserver | grep encryption-provider-config\n\n# View the encryption configuration\ncat \u002Fetc\u002Fkubernetes\u002Fenc\u002Fencryption-config.yaml\n```\n\nExpected secure configuration:\n\n```yaml\napiVersion: apiserver.config.k8s.io\u002Fv1\nkind: EncryptionConfiguration\nresources:\n  - resources:\n      - secrets\n      - configmaps\n    providers:\n      - aescbc:\n          keys:\n            - name: key1\n              secret: \u003Cbase64-encoded-32-byte-key>\n      - identity: {}  # Fallback for reading unencrypted data\n```\n\nVerify secrets are actually encrypted in etcd:\n\n```bash\n# Read a secret directly from etcd\nETCDCTL_API=3 etcdctl \\\n  --endpoints=https:\u002F\u002F127.0.0.1:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key \\\n  get \u002Fregistry\u002Fsecrets\u002Fdefault\u002Fmy-secret | hexdump -C | head -20\n\n# If encrypted, output starts with \"k8s:enc:aescbc:v1:key1\"\n# If NOT encrypted, you'll see plaintext key-value pairs\n```\n\n### 2. TLS Transport Security\n\n```bash\n# Verify etcd uses TLS for client connections\nETCDCTL_API=3 etcdctl endpoint health \\\n  --endpoints=https:\u002F\u002F127.0.0.1:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key\n\n# Check peer TLS configuration\nps aux | grep etcd | tr ' ' '\\n' | grep -E \"peer-cert|peer-key|peer-trusted-ca\"\n\n# Verify certificate expiration\nopenssl x509 -in \u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt -noout -enddate\nopenssl x509 -in \u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fpeer.crt -noout -enddate\n```\n\nExpected flags:\n\n| Flag | Required Value | Purpose |\n|------|---------------|---------|\n| `--cert-file` | Path to server cert | Client-to-server TLS |\n| `--key-file` | Path to server key | Client-to-server TLS |\n| `--trusted-ca-file` | Path to CA cert | Client certificate validation |\n| `--peer-cert-file` | Path to peer cert | Peer-to-peer TLS |\n| `--peer-key-file` | Path to peer key | Peer-to-peer TLS |\n| `--peer-trusted-ca-file` | Path to peer CA | Peer certificate validation |\n| `--client-cert-auth` | true | Require client certificates |\n| `--peer-client-cert-auth` | true | Require peer certificates |\n\n### 3. Access Control\n\n```bash\n# Verify etcd is not exposed on all interfaces\nps aux | grep etcd | tr ' ' '\\n' | grep listen-client-urls\n# Should be: https:\u002F\u002F127.0.0.1:2379 (not 0.0.0.0)\n\n# Check who can access etcd certificates\nls -la \u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002F\n# Should be readable only by root\u002Fetcd user\n\n# Verify API server is the only etcd client\nss -tlnp | grep 2379\n# Only kube-apiserver should have connections\n```\n\n### 4. Backup Security\n\n```bash\n# Create an encrypted etcd backup\nETCDCTL_API=3 etcdctl snapshot save \u002Fbackup\u002Fetcd-snapshot.db \\\n  --endpoints=https:\u002F\u002F127.0.0.1:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key\n\n# Encrypt the backup file\ngpg --symmetric --cipher-algo AES256 \u002Fbackup\u002Fetcd-snapshot.db\n\n# Verify backup integrity\nETCDCTL_API=3 etcdctl snapshot status \u002Fbackup\u002Fetcd-snapshot.db --write-out=table\n```\n\n### 5. Network Isolation\n\n```bash\n# Verify etcd ports are firewalled\niptables -L -n | grep -E \"2379|2380\"\n\n# Check if etcd is accessible from worker nodes (should NOT be)\n# Run from a worker node:\ncurl -k https:\u002F\u002F\u003Ccontrol-plane-ip>:2379\u002Fhealth\n# Should be rejected\u002Ftimeout\n```\n\n## CIS Benchmark Checks\n\n| CIS Control | Check | Expected Result |\n|-------------|-------|----------------|\n| 2.1 | etcd cert-file set | TLS certificate configured |\n| 2.2 | etcd client-cert-auth | Client certificate authentication enabled |\n| 2.3 | etcd auto-tls disabled | auto-tls=false |\n| 2.4 | etcd peer cert-file set | Peer TLS configured |\n| 2.5 | etcd peer client-cert-auth | Peer authentication enabled |\n| 2.6 | etcd peer auto-tls disabled | peer-auto-tls=false |\n| 2.7 | etcd unique CA | Separate CA for etcd (not shared with cluster) |\n\n## Key Rotation Procedure\n\n```bash\n# 1. Generate new encryption key\nNEW_KEY=$(head -c 32 \u002Fdev\u002Furandom | base64)\n\n# 2. Update EncryptionConfiguration with new key first\ncat > \u002Fetc\u002Fkubernetes\u002Fenc\u002Fencryption-config.yaml \u003C\u003CEOF\napiVersion: apiserver.config.k8s.io\u002Fv1\nkind: EncryptionConfiguration\nresources:\n  - resources:\n      - secrets\n    providers:\n      - aescbc:\n          keys:\n            - name: key2\n              secret: ${NEW_KEY}\n            - name: key1\n              secret: \u003Cold-key>\n      - identity: {}\nEOF\n\n# 3. Restart API server to pick up new config\n# 4. Re-encrypt all secrets with new key\nkubectl get secrets --all-namespaces -o json | \\\n  kubectl replace -f -\n\n# 5. Remove old key from EncryptionConfiguration\n# 6. Restart API server again\n```\n\n## References\n\n- [Kubernetes etcd Encryption Documentation](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Fadminister-cluster\u002Fencrypt-data\u002F)\n- [CIS Kubernetes Benchmark - etcd Controls](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes)\n- [Securing etcd - K8s Security Guide](https:\u002F\u002Fk8s-security.geek-kb.com\u002Fdocs\u002Fbest_practices\u002Fcluster_setup_and_hardening\u002Fcontrol_plane_security\u002Fetcd_security_mitigation\u002F)\n- [Infosec: Encryption and etcd](https:\u002F\u002Fwww.infosecinstitute.com\u002Fresources\u002Fcryptography\u002Fencryption-and-etcd-the-key-to-securing-kubernetes\u002F)\n","# Performing Kubernetes etcd Security Assessment\n\n## Overview\n\netcd is the distributed key-value store that serves as Kubernetes' backing store for all cluster data, including Secrets, RBAC policies, ConfigMaps, and workload configurations. Without proper hardening, etcd exposes all cluster secrets in plaintext, making it the highest-value target for attackers who gain control plane access. A comprehensive security assessment covers encryption at rest, TLS for transport, access control, backup security, and network isolation.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing kubernetes etcd security assessment\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Access to Kubernetes control plane nodes\n- SSH access to etcd cluster nodes (or etcdctl configured)\n- CIS Kubernetes Benchmark reference document\n- Understanding of TLS certificate management and EncryptionConfiguration\n\n## Assessment Areas\n\n### 1. Encryption at Rest\n\nVerify that Kubernetes encrypts Secret data stored in etcd:\n\n```bash\n# Check if EncryptionConfiguration is configured on API server\nps aux | grep kube-apiserver | grep encryption-provider-config\n\n# View the encryption configuration\ncat \u002Fetc\u002Fkubernetes\u002Fenc\u002Fencryption-config.yaml\n```\n\nExpected secure configuration:\n\n```yaml\napiVersion: apiserver.config.k8s.io\u002Fv1\nkind: EncryptionConfiguration\nresources:\n  - resources:\n      - secrets\n      - configmaps\n    providers:\n      - aescbc:\n          keys:\n            - name: key1\n              secret: \u003Cbase64-encoded-32-byte-key>\n      - identity: {}  # Fallback for reading unencrypted data\n```\n\nVerify secrets are actually encrypted in etcd:\n\n```bash\n# Read a secret directly from etcd\nETCDCTL_API=3 etcdctl \\\n  --endpoints=https:\u002F\u002F127.0.0.1:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key \\\n  get \u002Fregistry\u002Fsecrets\u002Fdefault\u002Fmy-secret | hexdump -C | head -20\n\n# If encrypted, output starts with \"k8s:enc:aescbc:v1:key1\"\n# If NOT encrypted, you'll see plaintext key-value pairs\n```\n\n### 2. TLS Transport Security\n\n```bash\n# Verify etcd uses TLS for client connections\nETCDCTL_API=3 etcdctl endpoint health \\\n  --endpoints=https:\u002F\u002F127.0.0.1:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key\n\n# Check peer TLS configuration\nps aux | grep etcd | tr ' ' '\\n' | grep -E \"peer-cert|peer-key|peer-trusted-ca\"\n\n# Verify certificate expiration\nopenssl x509 -in \u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt -noout -enddate\nopenssl x509 -in \u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fpeer.crt -noout -enddate\n```\n\nExpected flags:\n\n| Flag | Required Value | Purpose |\n|------|---------------|---------|\n| `--cert-file` | Path to server cert | Client-to-server TLS |\n| `--key-file` | Path to server key | Client-to-server TLS |\n| `--trusted-ca-file` | Path to CA cert | Client certificate validation |\n| `--peer-cert-file` | Path to peer cert | Peer-to-peer TLS |\n| `--peer-key-file` | Path to peer key | Peer-to-peer TLS |\n| `--peer-trusted-ca-file` | Path to peer CA | Peer certificate validation |\n| `--client-cert-auth` | true | Require client certificates |\n| `--peer-client-cert-auth` | true | Require peer certificates |\n\n### 3. Access Control\n\n```bash\n# Verify etcd is not exposed on all interfaces\nps aux | grep etcd | tr ' ' '\\n' | grep listen-client-urls\n# Should be: https:\u002F\u002F127.0.0.1:2379 (not 0.0.0.0)\n\n# Check who can access etcd certificates\nls -la \u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002F\n# Should be readable only by root\u002Fetcd user\n\n# Verify API server is the only etcd client\nss -tlnp | grep 2379\n# Only kube-apiserver should have connections\n```\n\n### 4. Backup Security\n\n```bash\n# Create an encrypted etcd backup\nETCDCTL_API=3 etcdctl snapshot save \u002Fbackup\u002Fetcd-snapshot.db \\\n  --endpoints=https:\u002F\u002F127.0.0.1:2379 \\\n  --cacert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fca.crt \\\n  --cert=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.crt \\\n  --key=\u002Fetc\u002Fkubernetes\u002Fpki\u002Fetcd\u002Fserver.key\n\n# Encrypt the backup file\ngpg --symmetric --cipher-algo AES256 \u002Fbackup\u002Fetcd-snapshot.db\n\n# Verify backup integrity\nETCDCTL_API=3 etcdctl snapshot status \u002Fbackup\u002Fetcd-snapshot.db --write-out=table\n```\n\n### 5. Network Isolation\n\n```bash\n# Verify etcd ports are firewalled\niptables -L -n | grep -E \"2379|2380\"\n\n# Check if etcd is accessible from worker nodes (should NOT be)\n# Run from a worker node:\ncurl -k https:\u002F\u002F\u003Ccontrol-plane-ip>:2379\u002Fhealth\n# Should be rejected\u002Ftimeout\n```\n\n## CIS Benchmark Checks\n\n| CIS Control | Check | Expected Result |\n|-------------|-------|----------------|\n| 2.1 | etcd cert-file set | TLS certificate configured |\n| 2.2 | etcd client-cert-auth | Client certificate authentication enabled |\n| 2.3 | etcd auto-tls disabled | auto-tls=false |\n| 2.4 | etcd peer cert-file set | Peer TLS configured |\n| 2.5 | etcd peer client-cert-auth | Peer authentication enabled |\n| 2.6 | etcd peer auto-tls disabled | peer-auto-tls=false |\n| 2.7 | etcd unique CA | Separate CA for etcd (not shared with cluster) |\n\n## Key Rotation Procedure\n\n```bash\n# 1. Generate new encryption key\nNEW_KEY=$(head -c 32 \u002Fdev\u002Furandom | base64)\n\n# 2. Update EncryptionConfiguration with new key first\ncat > \u002Fetc\u002Fkubernetes\u002Fenc\u002Fencryption-config.yaml \u003C\u003CEOF\napiVersion: apiserver.config.k8s.io\u002Fv1\nkind: EncryptionConfiguration\nresources:\n  - resources:\n      - secrets\n    providers:\n      - aescbc:\n          keys:\n            - name: key2\n              secret: ${NEW_KEY}\n            - name: key1\n              secret: \u003Cold-key>\n      - identity: {}\nEOF\n\n# 3. Restart API server to pick up new config\n# 4. Re-encrypt all secrets with new key\nkubectl get secrets --all-namespaces -o json | \\\n  kubectl replace -f -\n\n# 5. Remove old key from EncryptionConfiguration\n# 6. Restart API server again\n```\n\n## References\n\n- [Kubernetes etcd Encryption Documentation](https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Ftasks\u002Fadminister-cluster\u002Fencrypt-data\u002F)\n- [CIS Kubernetes Benchmark - etcd Controls](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes)\n- [Securing etcd - K8s Security Guide](https:\u002F\u002Fk8s-security.geek-kb.com\u002Fdocs\u002Fbest_practices\u002Fcluster_setup_and_hardening\u002Fcontrol_plane_security\u002Fetcd_security_mitigation\u002F)\n- [Infosec: Encryption and etcd](https:\u002F\u002Fwww.infosecinstitute.com\u002Fresources\u002Fcryptography\u002Fencryption-and-etcd-the-key-to-securing-kubernetes\u002F)\n",{"name":5,"tags":49,"author":50,"domain":36,"license":15,"version":51,"nist_csf":52,"subdomain":38,"description":7,"mitre_attack":57},[27,32,37,34,31,33,30,29],"mahipal","1.0",[53,54,55,56],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[58,59,60,61,62],"T1610","T1611","T1609","T1525","T1573","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-kubernetes-etcd-security-assessment",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":74,"prompt":84,"zipAvailable":85},[75,78,81],{"tool":76,"command":77},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment",{"tool":79,"command":80},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment",{"tool":82,"command":83},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-kubernetes-etcd-security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002FSKILL.md",true,[87,93,98,104,108,112,118],{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Ftemplate.md","ASSET","资产文件",566,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002Fassets\u002Ftemplate.md",{"path":94,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002FLICENSE",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fapi-reference.md","REFERENCE","参考文档",1855,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002Freferences\u002Fapi-reference.md",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fstandards.md",930,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002Freferences\u002Fstandards.md",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fworkflows.md",737,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002Freferences\u002Fworkflows.md",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"scripts\u002Fagent.py","SCRIPT","脚本",8289,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002Fscripts\u002Fagent.py",{"path":119,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fprocess.py",7589,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-kubernetes-etcd-security-assessment\u002Fscripts\u002Fprocess.py",[123,150,172,199,225,252],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":132,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[133,134,135,136,24,36,137,138,42,139,140,141,142,143,144,145,146,147,148,149],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":157,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[156],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[158,146,159,160,24,41,36,42,161,162,163,164,165,166,167,30,168,169,170,171],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":182,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[178,181],{"categoryNo":179,"categoryName":180,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[167,33,183,184,185,36,186,187,161,188,189,190,191,192,193,194,195,196,197,198],"recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":206,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[205],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[207,208,209,36,210,211,212,213,214,215,216,217,218,219,220,221,164,222,223,224],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":226,"name":227,"nameZh":6,"description":228,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":229,"categories":230,"keywords":232,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[231],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,235,36,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":259,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[258],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},[24,260,36,261,262,263,264,265,266,267,268,194,269,195,270,271,272,273,274,275],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]